2023
2023
3%) ]
I I
[ Forward 2 sec. / Keyframe / 00: 02 :22 (41 .3%) ]
Data
Data can be any raw fact used to make decisions.
Information
I I
[ Forward 2 sec. / Keyframe / 00:03 :16 (57 .0%)]
• Availability
• Accuracy
• Authenticity
• Confidentiality
• Confidentiality
I I
[ Forward 10 sec./ Keyframe / 00 :00 :16 (2 .8%)]
Imagine you are responsible for securing confidential data. What if this
information was stolen? What if your competitor accessed this
information?
I I
An ISMS is a framework of policies and procedures for ameliorating risk.
I I
An ISMS is a systematic approach to managing sensitive company
information so that it remains secure.
• Confidentiality
• Integrity
• Availability
I I
[ Forward 10 sec. / Keyframe / 00 :07 :20 (77 .5%) ]
Confidentiality
Confidentiality refers to protecting information from being accessed by
unauthorized parties.
Integrity
Integrity refers to the consistency, accuracy, and trustworthiness of data
over its entire lifecycle.
I I
Availability
The availability of data is also very important. If the data is stored in a
database, it is very important that the business or authorized user can
access it when needed.
I I
[ Forward 10 sec. / Keyframe / 00 :00 :24 (7 .0%) ]
• What the motive was and what kind of information was stolen
• What the impact was
• How the security breach happened
I I
[ Forward 10 sec./ Keyframe / 00 :00 :54 (15.7%)]
Yahoo
•
I I
[ Forward 10 sec. / Keyframe / 00 :01 :04 (18 .6%) ]
Marriott International
I I
[ Forward 10 sec./ Keyframe / 00 :01 :54 (33 .1%)]
eBay
In May 2014, eBay reported a cyberattack in which all of its 145 million users' personal
details were stolen. That included their names, addresses, dates of birth, and
encrypted passwords.
I I
[ Forward 10 sec. / Keyframe / 00 :05 :24 (94.2%) ]
NHS Cyberattack
WannaCry crippled 200,000 computers with a
message demanding cryptocurrency in bitcoin.
This attack resulted in about $112 million in
losses.
I I
[ Forward 10 sec. / Keyframe / 00 :00 :22 (2 .6%) ]
After reading these real-life scenarios, you can see where information security may
apply to you and your organization.
Scenario 1: Banking
Banking transactions are part of our day-to-day activities and most people have one
or more savings accounts. According to the Global Findex World Bank report, 69
percent of adults have an account, up from 62 percent in 2014 and 51 percent in 2011.
The numbers clearly show that banking is integral to our daily life and hence securing
that data is a continuous challenge.
I I
[ Forward 10 sec. / Keyframe / 00 :04: 52 (34.7%) ]
Retail
t
BMklng Automated
Teller Machl:ne
Issuing
SWitch
I I
[ Forward 10 sec./ Keyframe / 00 :06 :12 (44.2%)]
Management may feel mistrustful of the employees, thinking that they are the origin of
this breach. The outside world may be concerned that the company cannot protect its
confidential data.
I I
Once the business need is clear, you can implement a robust ISMS
(Information Security Management System) that covers the needs of the
interested parties and customers.
As per ISO 31000 Clause 5.3.1, these issues can be of two types:
• Internal issues: Factors that are under the control of the organization.
• External Issues: Factors that the organization cannot control.
[ Forward 10 sec. / Keyframe / 00 :02 :46 (37 .8%) ]
• Organizational structure
• Organizational culture
• Available resources
If the business context is not clear, workers won't be able to meet the
organization's set objectives. To understand this in a more holistic manner,
let's look at this from different industry angles:
• IT/hardware/software organization
• Banking organization
• Banking organization
These are just a few examples to show you why it's worth it to invest your
time and money in implementing ISO 27001 security practices.
[ Forward 10 sec. / Keyframe / 00 :00 :24 (4.5%) ]
Once you are clear about the business need, the next big step is to assess
the scope of the implementation within the organization.
There are numerous factors involved in identifying the scope. You need to
consider the organization entities, locations, geographies, business units,
departments, any products or services that are offered.
[ Forward 10 sec./ Keyframe / 00 :02 :14 (24.9%)]
You can take three main steps to identify the scope of implementation for
your organization's ISMS:
• Scope document
• Statement of applicability
The CISO has the authority to form a team to work on the implementation
of ISO 27001. In general, the team includes the following members:
I I
What Is the Statement of Applicability (SOA)?
The Statement of Applicability (SOA) goes hand in hand with the scope identification
exercise. It is an important document that helps you look for the areas to be included
in your ISMS.
I I
I I
[ Forward 10 sec. / Keyframe / 00 :08 :48 (98 .1%) ]
Responsibility
g ' -
•• • I
• •
rmJ •
'
Q
.·-·-
•
a
aO
I I
•
[ Forward 10 sec. / Keyframe / 00 :00 :22 (7 .3%) ]
Once the ISMS scope is defined and you have a clear understanding of what is needed
to implement it, you need to create a timeframe to achieve the objectives.
I I
[ Forward 10 sec./ Keyframe / 00 :03 :12 (63 .8%)]
I I
[ Forward 10 sec./ Keyframe / 00 :03 :52 (77 .1%)]
Top management's commitment and involvement can make the expected benefits of
the ISMS program achievable, as follows:
I I
[ Forward 10 sec./ Keyframe / 00 :00 :26 (5.7%)]
In the previous chapter, you learned about setting the scope and timeline
of your implementation.
This chapter also talks about how to get stakeholder and team
commitment on the project and how to set the timeline and create the
project taskforce.
t "Gn'S
I ...... (t:;r.em
2 NlwUI <--•
•
Administration Department
This is one of the most important roles in the ISMS implementation. This
person is responsible for maintaining the security of the organization's
network and other information-processing facilities
---
[ Forward 10 sec. / Keyframe / 00 :01 :24 (48 .6%) ]
""'
◄,►
t
, ~
~~
This important step involves getting commitment from the team.
Commitment to achieve something new mostly comes from the top. Once
you get management-level commitment, it's easier to get commitment
from the people doing the work.
• • •••• •
• • ••
• •
•• • •
• •
[ Forward 10 sec. / Keyframe / 00 :01 : 14 (21 .6%) ]
CISO Name;
I ••
To plan the meeting or risk assessment sessions,
first meet with the individual teams one by one.
That way, you can focus on the areas that each
team is responsible for, and it will reduce the
chances of missing a key security area.
•
[ Forward 10 sec. / Keyframe / 00 :03 :38 (24.9%) ]
The objective of Clause 14.2 is to ensure that when the development team
works, the development lifecycle will remain secure throughout the
development or product's/ application's life.
[ Forward 10 sec./ Keyframe / 00 :08 :18 (56.8%)]
The secure development policy should guide the development team, and
all must adhere to this security policy. The security policy should cover at
least these issues:
Test Data
I I
[ Forward 10 sec./ Keyframe / 00 :12:38 (86.5%)]
So far, you have done the risk assessment exercise by meeting all the
teams. Now it is time to prepare the report based on the identified gaps.
---
-
-
[ Backward 10 sec./ Keyframe / 00 :00 :44 (37.3%)]
A 7.a Pt1ot to
•I C'IIJjpil,}rrftffld C'Ollll'artClj W.dti:&t.b&d tbtfr mJIClffl
kh a..-. «iaflekttd
c.atrol
k~wmlllwrfflr.ailo!.dwcb • ii c;,wlkfir,s for, .. ..,ei• m
A7l l IS!I.Wta.al"'l'ltdNtia~-:-au llfflf\" b ttpl.lt.- -..
.Jftd ttbla .aftd SA.Ill k ptopon to cJw t=stness r,qw.cfflffill.
thr '-»ulQtklll ol
tth~,.wt,
t._
lllfonillUOll t• -- ~ a-"" the Pff
Qlllcrol
Tirnm:aniicon.lkJons J1- lrac1lW :qJ'NUtfflt'S Wtl .. flDjJNJC<:I and n..,lrxton SZU!U
A11.2
ol&optoJLlifflil ' ""'""' &1v1r...,. ,._"" cq.uitLlt)j11e'1 rniieMlbllllff'sfor 1 w......
lot!:,,,«'1Wl Tit m-..a,. Cut •11.,.,,,, • .al"ld • · «ion ,. _.,. rt ti md t\ltm clwlr n1 ~ J.f'('Ur1l 1
Jes.
Co .....,
A.71.1 ~lllfrT'IN"'C rfl&»n 'IM.ll!Lllll'UIINlt 1h•D n'1'dr* ft:i flll')'<ts cor.i,n cton co •PW
oma.11i.
oc..,._ oltlr.
rilyl11attclr\lmc ,.. II ·
= l;,;;;
~.sr..i1oi.b b t 4 ~
kl;;;:111.;.__ _ _ _ _ _ _ __
c..u.l
A.7.t.2
OMut,I
A 7.1.1 1'tf'I' ' M .I f\,t .-J ;aM C'CIIICSldf,a •,J 41:ac-&pt ty protlPSS
~:_~•Inn ,-11o~c.......... •
A:7.31
[ Forward 10 sec. / Keyframe / 00 :01 :04 (54.2%) ]
Once the report is ready, you must plan a session and present the report
to the steering committee.
Once management sees this report, it will also act as an action tracker
with target dates. SAMPLE REPORT
■ Non Compliant Partly Compliant ■ Compliant
100
90
80
70
60
so
40
30
20
10
0
A-5 A-6 A•7 A-8 A-9 A-10 A-11 A-12 A-13 A-14 A-15 A-16 A-17 A-18
[ Forward 10 sec./ Keyframe / 00 :00 :14 (5.0%)]
Secori1y
Policy
Vulneribilities
Risk
Assets
Tolerance
J
Impacts ,__
Incidents
Consequence
[ Forward 10 sec. / Keyframe / 00 :01 :36 (34.0%) ]
Risk Components
• Assets
• Threats
• Vulnerabilities
• Impact
• Probability of occurrence
• Consequences
[ Forward 10 sec./ Keyframe / 00 :02 :16 (48 .2%)]
When you get input by analyzing a threat to an asset and determine the
associated vulnerabilities, you will arrive at a conclusion. If the identified
threat has the potential to exploit any vulnerabilities and negatively
impact an asset or group of assets, that constitutes a security risk.
The rank assigned to each risk is called its risk ranking. Risks are ranked into
four types, depending on the calculated risk value and the priority level of the
risk.
The idea is to prioritize the risks and to allocate resources appropriately for risk
treatment.
P4 No action required
[ Forward 10 sec. / Keyframe / 00 :01 :04 (7 .4%) ]
Risk Treatment
Risk Acceptance
• Budget/financial
• Environmental
• Organizational
• Technological
• Cultural
• Time-based
[ Forward 10 sec./ Keyframe / 00 :03 :24 (23 .7%)]
Risk Mitigation
• Threat reduction
• Vulnerability reduction
• Impact reduction
• Detection of unwanted event
• Recovery from unwanted event
[ Forward 10 sec. / Keyframe / 00 :04: 54 (34.2%) ]
Risk Avoidance
Risk Transfer
0
RISK
[ Forward 10 sec. / Keyframe / 00 :06 :20 (44.2%) ]
Identifying Assets
Asset Category
Asset Value
Each asset is assigned a value, called the asset value.
The asset value helps you identify and determine the appropriate protection for
the assets.
Asset Classification
Asset Labeling
Once you are done with the information asset classification process, it must be
labeled properly.
Asset labeling is the small step toward achieving better security, since
organizations deal with lots of information assets in their daily activities.
Hardware/Physical Asse1S
Data storage
cabinets
The main benefit of having an asset Safes
Server racks
register is that it gives you a list of Semces People
A few key points that need to be covered in this asset disposable policy are the
following:
This section explains how to track and maintain asset information in your
department, with examples. The following sections discuss some examples of
departments.
1111
1111
1111
II 1111 II
II 1111 II
[ Forward 10 sec. / Keyframe / 00 :03 :02 (41 .5%) ]
$
,,. s
l Oesl
Otcb
ll i wyi t:t l
,,
I
, ,
l
' H
,,
2
1
s £ 2 s
6 ]
1 pe 5 ! l
[ Forward 10 sec. / Keyframe / 00 :04:42 (64.2%) ]
IT Helpdesk Department
Whatever you call the IT support department, their functions and activities will
basically be the same. This department typically covers about 30-40% of the ISO
27001 security controls implementation.
IT Infrastructure Department
• Department
• Asset
• Category
• Asset value
• Threat
• Vulnerability
• Risk
[ Forward 10 sec. / Keyframe / 00 :01 :32 (27 .3%) ]
• Likelihood
• Impact
• Risk value
• Risk rank
• Risk priority
• Risk owner
• Existing controls
[ Forward 10 sec. / Keyframe / 00 :03 :22 (59 .9%) ]
[ Forward 10 sec. / Keyframe / 00 :04: 12 (7 4.8%) ]
~--- -~--
'92 ;fr-a z•tNIH
......,..........
_,_____ _ - •···--
-·~----
..... ~ .. -.!:;, - .,
--·-· ..
[ Forward 10 sec./ Keyframe / 00 :05 :12 (92 .6%)]
You may wonder why you need to revisit the SoA, as you already did so in an
earlier exercise.
Recall from an earlier chapter that you learned that you might have to revisit the
SoA, as when you proceed with the implementation, you may find areas or
scenarios that were skipped.
[ Forward 10 sec./ Keyframe / 00 :00 :14 (3 .8%)]
Awareness of the ISO 27001 standard should be planned and conducted at the
organizational level.
It is important to know what you are covering as part of the awareness content. It
should be easy for all employees to understand and they must remember them
as well.
• ••
[ Forward 10 sec. / Keyframe / 00 :02 :44 (44.4%) ]
Awareness Quiz
A quiz session makes the awareness training more interesting and attendees get
to play a game and learn at the same time. This is the best way to check whether
employees understood the awareness sessions.
The awareness session also helps implementation team members when writing
the policies and procedures
• •
• •
• •
[ Forward 10 sec./ Keyframe / 00 :03 :54 (63 .4%)]
••
To avoid defining too many procedures in the ISO •
•
27001 implementation, the policies cover how security
controls/practices should be implemented in the
·-
organization or in one of the business units of the
organization, as applicable.
[ Forward 10 sec. / Keyframe / 00 :05 :04 (82 .4%) ]
As mentioned, the applicable team members help define the policies that
affect their daily work routines. It is the combination of the information security
team and the members from the operational team who work together.
... ....,
[ Forward 10 sec. / Keyframe / 00 :05 :34 (90 .5%) ]
The following policies are examples based on the ISO 27001 standard.
Organizations c-a n prepare their policies as applicable.
-
[ Forward 10 sec./ Keyframe / 00 :03 :42 (35.7%)]
The main objective of the a•c ceptable usages policy is to document and define
the practices that users must agree to in order to access the organizational
network or Internet.
-
[ Forward 10 sec./ Keyframe / 00 :05 :12 (50 .2%)]
This document describes the asset management policy for all IT and non-IT
assets of the organization. The policy covers all information assets, such as
hardware, software, and data.
Antivirus Policy
The purpose of this policy is to help prevent the infection by computers and
other malicious code and to provide a virus-free environment.
This is one of the most important policies you'll create because it tells you how
to recover quickly from service interruption or disaster, whether natural or
man-made.
This policy helps reduce the risk of unauthorized access, loss, or damage of
information during and outside working hours.
POLICY
[ Forward 10 sec./ Keyframe / 00 :00 :12 (2 .6%)]
The purpose of this policy is to define how changes to information security are
managed and controlled, because when an organization undergoes changes
in terms of business processes, tools, and technologies, the security controls
may require revisions and there may be new controls to doc·u ment.
[ Forward 10 sec./ Keyframe / 00 :00 :52 (11 .3%)]
This policy tells you how securely the data is retained and how you dispose of
data when it's no longer needed.
Encryption Policy
The objective of this policy is to provide direction about the use of encryption
to protect information resources that contain, process, or transmit confidential
and business-sensitive information.
• ••
0100
0101
100
IOI
[ Forward 10 sec./ Keyframe / 00 :05 :42 (74.5%)]
This purpose of this policy is to define how the incident can be managed and
reported in the organization.
The purpose of this policy is to address the legal, statutory, regulatory, and
contractual obligations arising from the security and privacy requirements of
an organization.
Network Security and Information Transfer Policy
The purpose of this document is to secure the organization from physical and
environmental threats.
The purpose of this policy is to establish the guidelines for protecting the
confidential information belonging to users/employees/clients.
[ Forward 10 sec./ Keyframe / 00 :04:14 (57 .2%)]
Some examples that could help in identifying information security risks are as
follows:
• Analyze the project/product requirements risks
• Access control risks
• Business continuity risks
• Any legal/regulatory risks
• Contract risks
[ Forward 10 sec./ Keyframe / 00 :00 :12 (3 .1%)]
Explanation: The objective is to identify all the assets associated with the
organization and then define security controls needed to safeguard those
assets.
[ Forward 10 sec./ Keyframe / 00 :00 :52 (6.6%)]
• •
•
[ Forward 10 sec. / Keyframe / 00 :02 :02 (15.6%) ]
Rules for the acceptable use of information and assets associated with
information and information processin-g facilities should be identified,
documented, and implemented.
All employees and external party users should return all the organizational
assets in their possession upon termination of their employment, contract, or
agreement.
[ Forward 10 sec./ Keyframe / 00 :05 :52 (45.0%)]
Explanation: This control helps classify information, which is very important for
the organization.
[ Forward 10 sec. / Keyframe / 00 :06 :32 (50 .1%) ]
I
[ Forward 10 sec. / Keyframe / 00 :07 :22 (56.5%) ]
••
I I
I I
••
[ Forward 10 sec./ Keyframe / 00 :11 :32 (88.5%)]
This control explains the use of policy and protection of cryptographic keys.
The important aspect is about the management of keys throughout the
lifecycle.
[ Forward 10 sec. / Keyframe / 00 :00 :34 (8 .5%) ]
Security perimeters should be defined and used to protect areas that contain
either sensitive or critical information and information processing facilities.
I I
[ Forward 10 sec./ Keyframe / 00 :04:14 (63 .2%)]
I I
[ Forward 10 sec./ Keyframe / 00 :00 :12 (1 .2%)]
• •
-
I I
[ Forward 10 sec. / Keyframe / 00 :02 :02 (12 .3%) ]
I I
[ Forward 10 sec. / Keyframe / 00 :06 :04 (36.7%) ]
I I
[ Forward 10 sec. / Keyframe / 00 :09 :24 (56.9%) ]
I I
A.12.3.1 Information Backup (ISO 27001 Control)
I I
[ Forward 10 sec./ Keyframe / 00 :00 :12 (1 .6%)]
I I
[ Forward 10 sec./ Keyframe / 00 :03 :32 (27 .7%)]
I I
[ Forward 10 sec. / Keyframe / 00 :05 :38 (44.1%) ]
I I
a
a
a
a
a
[ Forward 10 sec./ Keyframe / 00 :00 :12 (2 .4%)]
I I
• •
[ Forward 10 sec. / Keyframe / 00 :05 : 50 (68 .8%) ]
I I
A.15.1.1 Information Security Policy for Supplier
Relationships (ISO 27001 Control)
I I
[ Forward 10 sec. / Keyframe / 00 :06 :22 (37 .3%) ]
I I
[ Forward 10 sec./ Keyframe / 00 :09 :10 (53 .8%)]
I I
[ Forward 10 sec./ Keyframe / 00 :13:10 (77 .2%)]
I I
[ Forward 10 sec./ Keyframe / 00 :15:50 (92 .9%)]
I I
•
[ Forward 10 sec./ Keyframe / 00 :00 :12 (2 .5%)]
I I
[ Forward 10 sec. / Keyframe / 00 :04:32 (56.1%) ]
I I
•
[ Forward 10 sec. / Keyframe / 00 :06 :06 (75.5%) ]
I I
•- [
•-
[ Forward 10 sec. / Keyframe / 00 :00 :24 (6.3%) ]
I
• Preparing an internal audit team I
•Conducting -a udits •
• Closing findings/gaps
• Planning improvement -- - --- -
• Communicating
-- -
--
1--- --
-- ---
• •
I I
[ Forward 10 sec. / Keyframe / 00 :01 :04 (16.9%) ]
I I
[ Forward 10 sec./ Keyframe / 00 :02 :14 (35.4%)]
I I
[ Forward 10 sec. / Keyframe / 00 :03 :44 (59 .3%) ]
• Experience of auditor
• Regional auditor
• Reputation
I I
[ Forward 10 sec. / Keyframe / 00 :05 :04 (80 .4%) ]
Conducting Audits
I I
--
--
- - -
-- -
-
[ Forward 10 sec./ Keyframe / 00 :00 :14 (4.3%)]
I I
Pre-Audit Meeting/Briefing
'11111111111
I I
[ Forward 10 sec. / Keyframe / 00 :04:36 (84.7%)]
•••
• • !:! •
•••
••
.
~
"'--·
:/ •-- r
4 •-
..
.:
=o
::i · - -
.• =~
•• .. =□
.. •• • ••
•
'•
I I
[ Forward 10 sec. / Keyframe / 00 :00 :22 (5.5%) ]
I I
[ Forward 10 sec. / Keyframe / 00 :02 :02 (30 .4%) ]
Planning Improvement
Once you complete the audit findings, it becomes important to assess where
your information security implementation is weak. For some organizations, this
can be their first implementation exercise or their first internal audit exercise.
Here are the sample examples, which could be the possible reasons for the
gaps:
• Lack of awareness
• Half implementation only
• The wrong implementation
I I
[ Forward 10 sec. / Keyframe / 00 :03 :32 (52 .9%) ]
Eliminating Gaps
-· ·-
I I
[ Forward 10 sec. / Keyframe / 00 :05 :02 (75.3%) ]
I I
[ Forward 10 sec. / Keyframe / 00 :05 :32 (82 .8%) ]
Com mu nicati ng
I I
[ Forward 10 sec./ Keyframe / 00 :00 :14 (3 .0%)]
•
[ Forward 10 sec. / Keyframe / 00 :03 :04 (39 .5%) ]
First way
If an organization is trying to implement the ISMS the first
time, it is best to schedule the review meeting after all
the policies and procedures are defined, the security = •••
controls are implemented, and one round of the internal
audit exercise has been completed. -- - -- .J
\...
[ Forward 10 sec. / Keyframe / 00 :03 :44 (48 .1%) ]
Second Way
On the day of the meeting, you can start the session with
the information security team. The CISO or information
security manager can review the agenda of the meeting
and then continue to present the points, as mentioned in
th is chapter. After the information.
... ... ~
[ Forward 10 sec. / Keyframe / 00 :02 :22 (90 .4%) ]
• Participants' names
• Meeting agenda
• Points discussed
• Action items, with owners and target dates
-
[ Forward 10 sec. / Keyframe / 00 :00 :32 (17 .5%) ]
If you refer to the meeting minutes that were prepared after the review meeting,
they should cover all the improvement initiatives. Each action item can be taken
as one improvement or broken into multiple improvements.
Communicate
Audit Preparation
Stage 1 Audit
Stage 2 Audit
Stage 3 Audit
Now it's time to prepare your team for the audit. Discuss 0
with the team and send an email if required about what •
they should expect to be asked and how to reply.
•
During this step, you need to close all the gaps or issues
shared by the auditor during the stage 1 audit. By this
time, the team will have c·o nfidence and will understand
the audit cycle, as they already went through a stage 1
audit.
[ Forward 10 sec./ Keyframe / 00 :07 :54 (96.5%)]
Step 9: Celebrate
This is an optional step, but your team has done well and
earned this valuable certificate. Time to celebrate this
achievement.
[ Forward 10 sec. / Keyframe / 00 :00 :22 (4.2%) ]
Audit Closure
Here are the key points that an auditor covers during the
audit closure meeting.
•
• •
•
0
• •
I
[ Forward 10 sec. / Keyframe / 00 :05 :46 (66.4%) ]
Executive Summary
SWOT analysis
• Strengths
• Weaknesses
• Opportunities
• Threats
[ Forward 10 sec./ Keyframe / 00 :00 :52 (34.7%)]
Finding Summary
Evidence Summary
I
[ Forward 10 sec. / Keyframe / 00 :01 :32 (25.3%) ]
Areas of Improvement
Monthly KPls/Reports
Employee Observations -
Employees use the system daily and usually observe
everything around them. They can share issues they observe,
which you might never think about.
Customers/CI ients
New Tools/Technology
0
When a new, pertinent technology/tool is launched in the
market, it becomes important to explore it. You need to
determine whether it would be useful to the organizations
you serve
Regulatory/Governmental Laws
Once the test passes without incident, you can roll it out in
a planned manner. It's still advisable to monitor it for few
more weeks or a month, to verify that everything is
running smoothly.
Measure Success
. . . ....
• • • • • •
• .• .• .• ' • . •
• • • • •
.. . . . ......... •
. ·.·.·.·.·.
. . ..... . . . . .. ' . .. . . .
.·.·.·.·
. . . . l+-+-f
•
.
• •
.. •
.
• • • •
.'
• •
. 1 •
...
• • • •
. ,..t ~-t--f
• • • • • ~ • l • "